Extracted

• • Target
    RFQ-000112030687.exe
  • Size 735KB
  • SHA256 68f6a5d1e90ce94fbc1fb4fb8d4a809dcb4fe8af2ab66e29fbe7678672949215
  • MD5 20d8a0b91eece28982e245d5b8bf4930
  • SHA1 547587e2b9d30491a9e6c47ba0b041f4bc2ececa
  • SHA512 4e7e9122ba8b7e76be7610a630c4bd569cd8b5704b7c749195af00a3b6a6fd7657bcedec67393f3e38febd7dfa08918359eab8422cde4148c922407690ab6a6e
  • SSDEEP 12288:VvYj8FwLm/S0hGiTYTkCoW+D43YZnuwUniwOVHzHj3k/Zu+J4QqeUK:Vgj8F68oEYTZ8nuwpVHrQ/wy4Qq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2